filename2017-06-28-Kovter-sample.exe
size503434 (0x7ae8a)
md51f79e7fbf6c51df9ac5697afd91c128d
typePE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
mimetypeapplication/x-dosexec
clamavWin.Dropper.Kovter-7000874-0 FOUND
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections8
TimeDateStamp0x3dd528fb
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x38a
Magic0x10b
LinkerVersion2.23
SizeOfCode0x14000
SizeOfInitializedData0x67000
SizeOfUninitializedData0x2c400
AddressOfEntryPoint0x45ea
BaseOfCode0x1000
BaseOfData0x15000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion1.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x84150
SizeOfHeaders0x400
CheckSum0x8557e
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MEW 11 SE 1.1 (Northfox)

Sections

namevavsizeraw sizeflags
.text0x10000x140000x13800R-X CODE
.data0x150000x344f00x34600RW- IDATA
.rdata0x4a0000x281ac0x28200R-- IDATA UDATA
.bss0x730000x40200RW- UDATA
.idata0x780000x2e700x3000RW- IDATA
.CRT0x7b0000x3000x400RW- IDATA
.tls`0x7c0000x200x200RW- IDATA
.rsrc0x7d0000x71500x7200R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x780000x2196
RESOURCE0x7d0000x6f68
EXCEPTION00x100
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#42961252
ICON#537521252
ICON#622161252
ICON#717361252
ICON#813841252
ICON#1096401252
ICON#1142641252
ICON#1224401252
ICON#1311281252
GROUP_ICON#1011321252
VERSION#19161252
module_namehintordfunction_name
SHELL32.dll230SHSetUnreadMailCountW
SHELL32.dll188SHGetPathFromIDListW
SHELL32.dll122SHBrowseForFolderW
SHELL32.dll29DoEnvironmentSubstW
SHELL32.dll266ShellExecuteW
SHELL32.dll152SHExtractIconsW
SHLWAPI.dll42PathFindExtensionW
SHLWAPI.dll120PathStripToRootW
SHLWAPI.dll84PathIsUNCW
SHLWAPI.dll108PathRemoveFileSpecW
SHLWAPI.dll44PathFindFileNameW
WINSPOOL.DRV98ExtDeviceMode
WINSPOOL.DRV126OpenPrinterW
USER32.dll273GetDlgItem
USER32.dll634SetTimer
USER32.dll687UnionRect
USER32.dll682TranslateMessage
USER32.dll611SetMenuItemInfoW
USER32.dll325GetParent
USER32.dll2AdjustWindowRectEx
USER32.dll599SetForegroundWindow
USER32.dll150DestroyIcon
USER32.dll566SendDlgItemMessageA
USER32.dll345GetSubMenu
USER32.dll347GetSysColorBrush
USER32.dll331GetPropW
USER32.dll151DestroyMenu
USER32.dll526RealChildWindowFromPoint
USER32.dll86CreateDialogParamW
USER32.dll651SetWindowsHookExW
USER32.dll394InflateRect
USER32.dll647SetWindowTextW
USER32.dll620SetRect
USER32.dll249GetClassInfoW
USER32.dll268GetDC
USER32.dll162DispatchMessageW
USER32.dll318GetMessageW
USER32.dll485MessageBoxW
USER32.dll300GetMenu
USER32.dll362GetWindow
USER32.dll255GetClientRect
USER32.dll721WinHelpW
USER32.dll296GetLastActivePopup
USER32.dll57CheckMenuItem
USER32.dll272GetDlgCtrlID
USER32.dll658ShowWindow
USER32.dll289GetKeyState
USER32.dll440LoadBitmapW
USER32.dll382GrayStringW
USER32.dll200EndPaint
USER32.dll377GetWindowTextLengthW
USER32.dll561ScreenToClient
USER32.dll609SetMenuItemBitmaps
USER32.dll279GetForegroundWindow
USER32.dll97CreateWindowExW
USER32.dll278GetFocus
USER32.dll253GetClassNameW
USER32.dll515PostQuitMessage
USER32.dll557RemovePropW
USER32.dll198EndDialog
USER32.dll444LoadCursorW
USER32.dll619SetPropW
USER32.dll425IsRectEmpty
USER32.dll64ClientToScreen
USER32.dll251GetClassLongW
USER32.dll270GetDesktopWindow
USER32.dll302GetMenuCheckMarkDimensions
USER32.dll190DrawTextExW
USER32.dll433IsWindowVisible
USER32.dll436KillTimer
USER32.dll512PeekMessageW
USER32.dll418IsDialogMessageW
USER32.dll194EnableMenuItem
USER32.dll349GetSystemMetrics
USER32.dll355GetTopWindow
USER32.dll50CharToOemBuffW
USER32.dll589SetCursor
USER32.dll367GetWindowLongW
USER32.dll372GetWindowRect
USER32.dll402IntersectRect
USER32.dll317GetMessageTime
USER32.dll48CharToOemA
USER32.dll554ReleaseDC
USER32.dll223EqualRect
USER32.dll446LoadIconW
USER32.dll699UpdateWindow
USER32.dll429IsWindow
USER32.dll243GetCapture
USER32.dll307GetMenuItemID
USER32.dll306GetMenuItemCount
USER32.dll323GetNextDlgTabItem
USER32.dll13BeginPaint
USER32.dll403InvalidateRect
USER32.dll668TabbedTextOutW
USER32.dll430IsWindowEnabled
USER32.dll552RegisterWindowMessageW
USER32.dll196EnableWindow
USER32.dll74CopyRect
USER32.dll84CreateDialogIndirectParamW
USER32.dll500OffsetRect
USER32.dll676TrackPopupMenu
USER32.dll94CreatePopupMenu
USER32.dll473MapWindowPoints
USER32.dll523PtInRect
USER32.dll497OemToCharBuffA
USER32.dll605SetMenu
USER32.dll643SetWindowPos
USER32.dll579SetActiveWindow
USER32.dll707ValidateRect
USER32.dll490MonitorFromWindow
USER32.dll379GetWindowThreadProcessId
USER32.dll496OemToCharA
USER32.dll55CharUpperW
USER32.dll598SetFocus
USER32.dll346GetSysColor
USER32.dll248GetClassInfoExW
USER32.dll267GetCursorPos
USER32.dll316GetMessagePos
USER32.dll537RegisterClassW
USER32.dll191DrawTextW
ole32.dll15CoCreateGuid
ole32.dll28CoFreeUnusedLibraries
ole32.dll101CoTaskMemRealloc
ole32.dll104CoUninitialize
ole32.dll58CoInitialize
ole32.dll308StringFromGUID2
ole32.dll99CoTaskMemAlloc
ole32.dll16CoCreateInstance
ole32.dll8CLSIDFromString
ole32.dll59CoInitializeEx
ole32.dll100CoTaskMemFree
ADVAPI32.dll463RegCreateKeyW
ADVAPI32.dll483RegOpenKeyExW
ADVAPI32.dll471RegEnumKeyExW
ADVAPI32.dll465RegDeleteKeyW
ADVAPI32.dll507RegSetValueW
ADVAPI32.dll467RegDeleteValueW
ADVAPI32.dll494RegQueryValueW
ADVAPI32.dll493RegQueryValueExW
ADVAPI32.dll457RegCloseKey
ADVAPI32.dll472RegEnumKeyW
OLEAUT32.dll314
OLEAUT32.dll417
OLEAUT32.dll9
OLEAUT32.dll8
OLEAUT32.dll12
OLEAUT32.dll6
OLEAUT32.dll7
OLEAUT32.dll2
OLEACC.dll19LresultFromObject
OLEACC.dll21WindowFromAccessibleObject
OLEACC.dll4CreateStdAccessibleObject
GDI32.dll574SetViewportExtEx
GDI32.dll578SetWindowExtEx
GDI32.dll29CloseFigure
GDI32.dll555SetMapMode
GDI32.dll17BeginPath
GDI32.dll575SetViewportOrgEx
GDI32.dll519SaveDC
GDI32.dll592TranslateCharsetInfo
GDI32.dll50CreateDIBSection
GDI32.dll437GetTextExtentPoint32W
GDI32.dll445GetTextMetricsW
GDI32.dll143DeleteObject
GDI32.dll572SetTextColor
GDI32.dll71CreatePen
GDI32.dll512RestoreDC
GDI32.dll352GetClipBox
GDI32.dll212Escape
GDI32.dll534SetBkMode
GDI32.dll520ScaleViewportExtEx
GDI32.dll526SelectObject
GDI32.dll1AbortPath
GDI32.dll521ScaleWindowExtEx
GDI32.dll533SetBkColor
GDI32.dll469OffsetViewportOrgEx
GDI32.dll39CreateBitmap
GDI32.dll421GetStockObject
KERNEL32.dll827SetUnhandledExceptionFilter
KERNEL32.dll11AreFileApisANSI
KERNEL32.dll122DeleteCriticalSection
KERNEL32.dll46CloseHandle
KERNEL32.dll282GetConsoleCP
KERNEL32.dll473GetUserDefaultLCID
KERNEL32.dll105CreateThread
KERNEL32.dll615MoveFileW
KERNEL32.dll899WaitForSingleObject
KERNEL32.dll817SetThreadAffinityMask
KERNEL32.dll411GetProcessHeap
KERNEL32.dll537InitializeCriticalSection
KERNEL32.dll545InterlockedFlushSList
KERNEL32.dll641OutputDebugStringA
KERNEL32.dll795SetLastError
KERNEL32.dll548InterlockedPushEntrySList
KERNEL32.dll430GetShortPathNameW
KERNEL32.dll781SetFileAttributesW
KERNEL32.dll512GlobalUnlock
KERNEL32.dll869UnregisterWait
KERNEL32.dll530HeapSize
KERNEL32.dll526HeapQueryInformation
KERNEL32.dll188FileTimeToSystemTime
KERNEL32.dll822SetThreadPriority
KERNEL32.dll175ExitProcess
KERNEL32.dll409GetProcessAffinityMask
KERNEL32.dll437GetStringTypeW
KERNEL32.dll777SetEvent
KERNEL32.dll518HeapAlloc
KERNEL32.dll200FindFirstChangeNotificationW
KERNEL32.dll557IsDBCSLeadByte
KERNEL32.dll440GetSystemDefaultUILanguage
KERNEL32.dll945lstrcmpW
KERNEL32.dll528HeapReAlloc
KERNEL32.dll371GetLongPathNameW
KERNEL32.dll500GlobalFlags
KERNEL32.dll465GetThreadPriority
KERNEL32.dll74CreateEventW
KERNEL32.dll140DuplicateHandle
KERNEL32.dll597LocalReAlloc
KERNEL32.dll344GetFileAttributesExW
KERNEL32.dll782SetFilePointer
KERNEL32.dll106CreateTimerQueue
KERNEL32.dll350GetFileType
KERNEL32.dll264GetCommandLineA
KERNEL32.dll663QueryPerformanceCounter
KERNEL32.dll408GetProcAddress
KERNEL32.dll508GlobalReAlloc
KERNEL32.dll786SetFileTime
KERNEL32.dll442GetSystemDirectoryW
KERNEL32.dll313GetCurrentDirectoryW
KERNEL32.dll558IsDBCSLeadByteEx
KERNEL32.dll365GetLocaleInfoW
KERNEL32.dll496GlobalDeleteAtom
KERNEL32.dll377GetModuleHandleExW
KERNEL32.dll546InterlockedIncrement
KERNEL32.dll889VirtualProtect
KERNEL32.dll843SwitchToThread
KERNEL32.dll594LocalFree
KERNEL32.dll589LoadResource
KERNEL32.dll197FindClose
KERNEL32.dll166EnumSystemLocalesW
KERNEL32.dll697RemoveDirectoryW
KERNEL32.dll679ReadConsoleW
KERNEL32.dll590LocalAlloc
KERNEL32.dll238FreeEnvironmentStringsW
KERNEL32.dll212FindNextFileW
KERNEL32.dll314GetCurrentProcess
KERNEL32.dll667RaiseException
KERNEL32.dll245GetACP
KERNEL32.dll865UnlockFile
KERNEL32.dll128DeleteTimerQueueTimer
KERNEL32.dll399GetPrivateProfileIntW
KERNEL32.dll771SetEndOfFile
KERNEL32.dll125DeleteFileW
KERNEL32.dll468GetThreadTimes
KERNEL32.dll349GetFileTime
KERNEL32.dll505GlobalLock
KERNEL32.dll494GlobalAlloc
KERNEL32.dll432GetStartupInfoW
KERNEL32.dll501GlobalFree
KERNEL32.dll317GetCurrentThread
KERNEL32.dll361GetLastError
KERNEL32.dll504GlobalHandle
KERNEL32.dll335GetEnvironmentStringsW
KERNEL32.dll187FileTimeToLocalFileTime
KERNEL32.dll681ReadFile
KERNEL32.dll916WriteFile
KERNEL32.dll339GetExitCodeThread
KERNEL32.dll405GetPrivateProfileStringW
KERNEL32.dll39ChangeTimerQueueTimer
KERNEL32.dll854TlsGetValue
KERNEL32.dll375GetModuleHandleA
KERNEL32.dll603LockResource
KERNEL32.dll72CreateDirectoryW
KERNEL32.dll853TlsFree
KERNEL32.dll524HeapFree
KERNEL32.dll900WaitForSingleObjectEx
KERNEL32.dll345GetFileAttributesW
KERNEL32.dll538InitializeCriticalSectionAndSpinCount
KERNEL32.dll642OutputDebugStringW
KERNEL32.dll542InterlockedDecrement
KERNEL32.dll944lstrcmpA
KERNEL32.dll922WritePrivateProfileStringW
KERNEL32.dll886VirtualFree
KERNEL32.dll855TlsSetValue
KERNEL32.dll475GetUserDefaultUILanguage
KERNEL32.dll559IsDebuggerPresent
KERNEL32.dll587LoadLibraryW
KERNEL32.dll844SystemTimeToFileTime
KERNEL32.dll348GetFileSizeEx
KERNEL32.dll547InterlockedPopEntrySList
KERNEL32.dll838SizeofResource
KERNEL32.dll839Sleep
KERNEL32.dll837SignalObjectAndWait
KERNEL32.dll373GetModuleFileNameA
KERNEL32.dll318GetCurrentThreadId
KERNEL32.dll583LeaveCriticalSection
KERNEL32.dll107CreateTimerQueueTimer
KERNEL32.dll347GetFileSize
KERNEL32.dll378GetModuleHandleW
KERNEL32.dll235FormatMessageW
KERNEL32.dll810SetStdHandle
KERNEL32.dll82CreateHardLinkW
KERNEL32.dll433GetStdHandle
KERNEL32.dll618MulDiv
KERNEL32.dll143EnterCriticalSection
KERNEL32.dll80CreateFileW
KERNEL32.dll252GetCPInfo
KERNEL32.dll571LCMapStringW
KERNEL32.dll354GetFullPathNameW
KERNEL32.dll584LoadLibraryA
KERNEL32.dll204FindFirstFileW
KERNEL32.dll493GlobalAddAtomW
KERNEL32.dll539InitializeSListHead
KERNEL32.dll241FreeResource
KERNEL32.dll221FindResourceW
KERNEL32.dll592LocalFileTimeToFileTime
KERNEL32.dll601LockFile
KERNEL32.dll915WriteConsoleW
KERNEL32.dll198FindCloseChangeNotification
KERNEL32.dll482GetVolumeInformationW
KERNEL32.dll374GetModuleFileNameW

StringTable 2C0904E4

FileVersion9.00.26
LegalCopyrightBonVojalih (C) 2005-2006 CyberLink Corp.
FileDescriptionBonVojalih PowerDVD Embedded Main Program
ProductNameBonVojalih PowerDVD Embedded
CompanyNameBonVojalih Corp.
InternalNameBonVojalih PowerDVD Embedded Main Program
OriginalFilenamePowerDVD.exe
ProductVersion9.00.26

VS_FIXEDFILEINFO

FileVersion9.0.2605.0
ProductVersion9.0.2605.0
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS4
FileType1
FileSubtype0
offsetsizetypecomment
0502784EXE11/15/2002 17:03:55#
15c115HTM#
7ac00650BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 503434 bytes (492 KiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x0